CVE-2024-0204: Fortra GoAnywhere MFT authentication bypass in admin portal

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable bypass that yields full admin control of a sensitive file transfer server, with a CVSS of 9.8 and near-maximum EPSS.

What it is

GoAnywhere MFT before 7.4.1 contains an authentication bypass (CWE-425, forced browsing) in the administration portal that lets an unauthenticated user create an administrative account. Because the resulting account is a full admin, the flaw effectively hands over control of the managed file transfer server, a high-value system that often holds credentials and moves sensitive data.

Impact

An unauthenticated attacker gains a working administrative account on the GoAnywhere MFT instance, giving full control over its configuration, file transfer jobs and stored credentials. From there the attacker can read or move transferred data and potentially pivot into connected systems.

Attack surface

Reachable over the network through the administration portal; the CVSS vector is AV:N/AC:L/PR:N/UI:N, so no authentication and no user interaction are required. The description does not specify whether the portal must be internet-facing or which exact endpoint is abused.

Exploitation

Not listed in CISA KEV and no ransomware group is documented in this record, but EPSS is very high (0.95086, 99.859th percentile), indicating strong likelihood of exploitation. Reference tags include a third-party advisory and a Packet Storm entry for unauthenticated remote code execution, suggesting public technical detail exists, though the record does not confirm active exploitation.

What to do

• Upgrade GoAnywhere MFT to 7.4.1 or later; this is the only complete fix.
• If immediate patching is not possible, restrict access to the administration portal to trusted management networks and block it from the internet.
• Audit existing admin accounts for unauthorized or unexpected additions and remove any that cannot be accounted for.
• Rotate credentials and keys stored or managed by the GoAnywhere instance if compromise is suspected.
• Monitor vendor advisory FI-2024-001 for updated guidance.

Detection

• Review GoAnywhere MFT logs for admin account creation events, especially from unexpected source IPs or outside change windows.
• Alert on access to administration portal endpoints from unauthenticated or external sources.
• Baseline the set of administrative accounts and alert on any new admin user.
• Correlate portal access with subsequent configuration changes, job creation or outbound connections.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.